Because of inherent security concerns, mobile communications devices such as mobile phones, PDAs, and smartphones have yet to provide the same breadth of trusted connectivity found on desktop and laptop computer platforms. For example, mobile device users are less likely to access confidential information and/or perform financial transactions with a mobile communications device because such devices are not sufficiently secure. Similarly, service providers such as banks, online payment services and providers of confidential information are less likely to offer access to their services through mobile communications devices. As a result, mobile communications device users are limited by the types and availability of many online services. This is because present methods for securing mobile communications devices do not contemplate many ways users may wish to access online services and online service providers, and are therefore inadequate for providing a secure platform for access to and from online services or service providers.
Previous methods for securing mobile communications devices focus on an all-or-nothing approach. Access to or from the mobile device is either granted or not granted based upon whether the device meets certain standards, possesses certain configurations, or adheres to certain policy rules. If the device passes these standards, access is granted. If the device is deficient in any way, access is denied. Such an approach does not consider the types or levels of access required by certain service providers, nor does this approach contemplate the security and repair capabilities of the device itself. Indeed, prior art security systems and methods ignore the recent activity of the mobile device in relation to its overall security state. Furthermore, prior art security systems are typically limited to authorizing access to a given network, making them unsuitable for controlling access and access levels to services and service providers based on a device's security state.
What is therefore needed is a system and method for providing security for mobile communications devices that considers the security state of the device and provides a platform for integrating with services and service providers.